bug#29177: Hidden packages are not accounted for by `guix refresh`

bug#29177: Hidden packages are not accounted for by `guix refresh`

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 581 bytes --]

Currently, some packages are marked as "hidden".  This makes `guix
refresh` fail to realize the full impact of a change.  Most notably this
affects 'xorg-server': there have already been a few commits that
rebuilds the for-test variant (and thus GTK) because they seemed to only
cause ~150 rebuilds, where in reality it's more than 400:

97ecd75e289d96a8b4f9b1ae877d9d1a2f6774b4 gnu: libxfont: Fix CVE-2017-13720, CVE-2017-13722.
c2eb8cd98c82277e851eb4302b7f12614e215a76 gnu: xorg-server: Build reproducibly.
9371600ec8397ab3d596dea89c388b4acb1c2437 gnu: libxres: Update to 1.2.0.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

bug#29177: Hidden packages are not accounted for by `guix refresh`

[Ludovic Courtès]

Hi Marius,

Marius Bakke <mbakke@fastmail.com> skribis:

> Currently, some packages are marked as "hidden".  This makes `guix
> refresh` fail to realize the full impact of a change.  Most notably this
> affects 'xorg-server': there have already been a few commits that
> rebuilds the for-test variant (and thus GTK) because they seemed to only
> cause ~150 rebuilds, where in reality it's more than 400:
>
> 97ecd75e289d96a8b4f9b1ae877d9d1a2f6774b4 gnu: libxfont: Fix CVE-2017-13720, CVE-2017-13722.
> c2eb8cd98c82277e851eb4302b7f12614e215a76 gnu: xorg-server: Build reproducibly.
> 9371600ec8397ab3d596dea89c388b4acb1c2437 gnu: libxres: Update to 1.2.0.

Oooops!  I’m the guilty party here.  The real dependency count can be
found with:

--8<---------------cut here---------------start------------->8---
$ guix refresh -l -e '(@ (gnu packages xorg) xorg-server-1.19.3)' xorg-server
Building the following 276 packages would ensure 516 dependent packages are rebuilt: snd@17.7 ardour@5.12 …
--8<---------------cut here---------------end--------------->8---

The problem is not that ‘xorg-server-1.19.3’ is hidden (we can work
around it with -e), but that it inherits from ‘xorg-server’, and thus
ended up being rebuilt.

That’s a “known limitation” of ‘guix refresh -l’ and not something
easily addressed since inheritance is purely syntactic.  Tricky!

So I think it’s “not a bug” from the ‘guix refresh’ viewpoint, but it’s
definitely a mistake on my side.  Apologies!

I think at this stage it’s no longer useful to revert this commit
though.  WDYT?

Thanks for the heads-up!

Ludo’.

bug#29177: Hidden packages are not accounted for by `guix refresh`

[Ludovic Courtès]

ludo@gnu.org (Ludovic Courtès) skribis:

> The problem is not that ‘xorg-server-1.19.3’ is hidden (we can work
> around it with -e), but that it inherits from ‘xorg-server’, and thus
> ended up being rebuilt.

Nevertheless, commit 8e57e416c0a6431a14d487ff8b69dece76d37c03 makes sure
‘guix refresh -l’ accounts for hidden packages.

For instance, previously it would not report the hidden ‘xorg-server’
when running ‘guix refresh -l dri2proto’; it now does.

I think it doesn’t change results significantly though.

Ludo’.

bug#29177: Hidden packages are not accounted for by `guix refresh`

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 940 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> ludo@gnu.org (Ludovic Courtès) skribis:
>
>> The problem is not that ‘xorg-server-1.19.3’ is hidden (we can work
>> around it with -e), but that it inherits from ‘xorg-server’, and thus
>> ended up being rebuilt.
>
> Nevertheless, commit 8e57e416c0a6431a14d487ff8b69dece76d37c03 makes sure
> ‘guix refresh -l’ accounts for hidden packages.
>
> For instance, previously it would not report the hidden ‘xorg-server’
> when running ‘guix refresh -l dri2proto’; it now does.

Thanks, that was fast!  Closing the bug.

> I think it doesn’t change results significantly though.

Maybe not, but at least people won't accidentally trigger a GTK rebuild
and soon 'net-tools-for-tests' because `guix refresh` missed it.

It would be good to reduce the inputs of these packages to the absolute
minimum in order to minimize the impact.  Something to think about.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]